A hacking group was observed exploiting a patched Cisco vulnerability to deploy a custom malware framework called KeyDrift in attacks on space and satellite services, defense and aerospace technology, and policy research organizations, Cisco Talos researchers reported. The group, tracked as UAT-11473, appears to overlap with the Chinese state-sponsored Volt Typhoon's 'Silent Train' covert access network, though Talos made no definitive links.
The attacks leveraged CVE-2026-20127, a maximum-severity authentication bypass flaw in Cisco Catalyst SD-WAN Controllers that was patched in February 2026. The vulnerability allows remote attackers to gain privileged access and add rogue peers. A different group, UAT-8616, has exploited it as a zero-day since at least 2023, and recent research connected that exploitation to Volt Typhoon.
According to a Lumen report released Wednesday, the Silent Train framework enabled Volt Typhoon to evade detection while carrying out zero-day vulnerability attacks. Cisco Talos said the UAT-11473 threat cluster appears to overlap with that network but made no definitive links.
The targets included space and satellite services, defense and aerospace technology, and policy research organizations. KeyDrift is a custom malware framework designed to operate on Cisco SD-WAN controller instances. "Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," the researchers said. "KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."
The malware has two primary components: PolyFlame and LittleFilch. Talos observed signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation. PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector. It supports command execution through a TinyShell-styled component, file uploads and downloads, and relay of communications between an attacker's command-and-control server and multiple peers. LittleFilch is a control-session interception module that hooks the SSL_read function to inspect decrypted control-plane messages. For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. It uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and transmits it over UDP to the attackers.
Cisco recommends that system administrators apply available security updates for CVE-2026-20127 and consult the vendor's dedicated hardening guide for Catalyst SD-WAN deployments.
Analysis
Why This Matters
- The targeting of SD-WAN controllers, a core network infrastructure component, shows attackers are increasingly focusing on undermining network trust at the routing layer, with potential cascading effects across entire enterprise and government networks
- Extraction of IPsec keying material could allow attackers to decrypt entire data flows, affecting communications confidentiality for months or years after the initial breach
- The apparent connection to a Chinese state-sponsored group highlights the strategic value placed on compromising telecom and satellite infrastructure for espionage purposes
Background
Cisco Catalyst SD-WAN controllers manage routing policies and encryption keys across wide-area networks, making them a high-value target for advanced persistent threat groups seeking to intercept communications. CVE-2026-20127, a critical authentication bypass flaw, was discovered being exploited in the wild before Cisco issued a patch in February 2026. The vulnerability allows an unauthenticated remote attacker to gain administrator-level access on affected devices. Volt Typhoon is a Chinese state-sponsored hacking group known for targeting critical infrastructure and maintaining persistent covert access networks.
What to Watch
- Whether other threat groups adopt KeyDrift or similar malware targeting SD-WAN controllers now that the techniques are publicly documented
- Cisco's investigation into whether any customers have reported successful KeyDrift infections and what remediation steps are taken
- The potential for additional vulnerabilities in Cisco SD-WAN products to be exploited as part of the same campaign chain
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedUAT-11473 exploited a Cisco SD-WAN flaw to deploy the custom KeyDrift malware, according to researchers.BleepingComputer: “A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.”
- SupportedTalos says UAT-11473 appears to overlap with Volt Typhoon’s Silent Train covert access network, but made no definitive links.BleepingComputer: “the UAT-11473 threat cluster appears to overlap with Volt Typhoon’s "Silent Train" covert access network, but they made no definitive links.”
- SupportedThe attacks targeted space and satellite services, defense and aerospace technology, and policy research organizations.BleepingComputer: “The attacks Cisco researchers observed targeted space and satellite services, defense and aerospace technology, and policy research organizations”
- SupportedCVE-2026-20127 is a maximum-severity authentication-bypass flaw that Cisco patched in February 2026.BleepingComputer: “CVE-2026-20127 is a max-severity flaw that Cisco patched in February 2026”
- SupportedThe flaw allows remote attackers to gain privileged access to Catalyst SD-WAN controllers and add rogue peers.BleepingComputer: “which allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and Manager and add rogue peers.”
- SupportedUAT-8616 has exploited the vulnerability as a zero-day since at least 2023, and recent research linked that exploitation to Volt Typhoon.BleepingComputer: “UAT-8616 has exploited the vulnerability as a zero-day since at least 2023 , and recent research also linked its exploitation to the Chinese Volt Typhoon state-sponsored hacking group.”
- Partly supportedLumen released its report on Wednesday, saying Silent Train enabled Volt Typhoon to evade detection during zero-day vulnerability attacks.BleepingComputer: “In a report Lumen released yesterday, researchers revealed that the Silent Train framework allowed Volt Typhoon to evade detection while conducting zero-day vulnerability attacks.”
- SupportedTalos said with high confidence that KeyDrift is designed for long-term persistent access and automated exfiltration of sensitive keying material.BleepingComputer: “"Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material," explained Cisco Talos .”
- SupportedTalos said KeyDrift can intercept decrypted control traffic, extract control-session metadata and data-plane keying material, and stage or transmit the collected material using encrypted records.BleepingComputer: “"KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records."”
- SupportedKeyDrift has two primary components, PolyFlame and LittleFilch, and Talos observed signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.BleepingComputer: “KeyDrift has two primary components, PolyFlame and LittleFilch, for which Talos saw signs of ongoing development, including new anti-debugging mechanisms and varied process impersonation.”
- SupportedPolyFlame runs inside legitimate vdaemon processes using modified startup scripts and an injector, and supports command execution, file transfers, and relaying communications between an attacker’s C2 server and multiple peers.BleepingComputer: “PolyFlame runs inside legitimate vdaemon processes using modified service startup scripts and an injector for deployment. It supports command execution through a TinyShell-styled component, file uploads and downloads, and relaying communications between an attacker’s command-and-control (C2) server and multiple peers.”
- SupportedLittleFilch hooks SSL_read to inspect decrypted control-plane messages; for predefined edge nodes it extracts IP identifiers and a 32-byte field assessed as AES-256 IPsec key material, encrypts the information with RSA, saves it to /var/tmp/vdaemon.bin, and sends it over UDP.BleepingComputer: “LittleFilch is a control-session interception module that hooks SSL_read to inspect control-plane messages after they have been decrypted inside the controller. For predefined edge nodes, it extracts IP identifiers and a 32-byte field that Talos assesses to be AES-256 IPsec data-plane key material. It uses RSA encryption to protect the collected information, saves it to /var/tmp/vdaemon.bin, and then transmits it over UDP to the attackers.”
